Entra Id
Monthly
Missing authorization in Microsoft Entra ID allows an attacker who already holds a valid low-privilege identity - a compromised user account, guest account, or service principal - to elevate privileges over the network without any user interaction, giving high impact to confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H). Microsoft has published an advisory through MSRC (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83941), but no public exploit code has been identified at time of analysis and the issue is not in CISA KEV; EPSS is only 0.73% (52nd percentile), so this is a genuine priority-worthy finding rather than an emergency. Because Entra ID is a Microsoft-operated multi-tenant cloud service, the affected code is centrally managed and the exact tenant configuration or feature exposing the missing check is not detailed in the advisory.
Privilege escalation in Microsoft Entra ID (formerly Azure Active Directory) lets a remote, unauthenticated attacker bypass authentication through an alternate path or channel and gain elevated privileges over the network. The flaw affects Microsoft's cloud identity-and-access-management service, which underpins sign-in and authorization for Microsoft 365, Azure, and countless federated third-party applications. No public exploit identified at time of analysis and SSVC records exploitation status as none, but the CISA SSVC framework rates the attack as automatable with total technical impact.
Spoofing vulnerability in Microsoft Entra ID (formerly Azure Active Directory) enables an authenticated low-privilege network attacker to forge or manipulate identity data due to insufficient verification of data authenticity (CWE-345), yielding high confidentiality, integrity, and availability impact. The CVSS 8.8 score with PR:L confirms a valid tenant account is required but no elevated privileges are needed, meaning any compromised or legitimately provisioned low-privilege account could serve as a launchpad. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Azure Entra ID (formerly Azure AD) has an elevation of privilege vulnerability allowing attackers to escalate permissions within the identity platform.
Authentication bypass in Microsoft Entra ID (CWE-306, missing authentication for a critical function) lets remote, unauthenticated attackers reach functionality that should require credentials, with maximum impact across confidentiality, integrity, and availability and a CVSS base score of 9.8 (AV:N/AC:L/PR:N/UI:N). Exploitation status is 'no public exploit identified at time of analysis' - the flaw is not listed in CISA KEV and no proof-of-concept was provided - but the EPSS score of 7.66% (94th percentile) marks it as substantially more likely to see exploitation attempts than the typical CVE. Multiple signals converge on genuine high priority, driven by the unauthenticated network vector, the critical-tier score, and the central role Entra ID plays as an identity provider for Microsoft cloud tenants; because Entra ID is a Microsoft-operated multi-tenant service, the vulnerable component is hosted and remediated by Microsoft rather than by customers on their own infrastructure.
Elevation of privilege in Microsoft Entra ID could enable an unauthenticated remote attacker to gain higher privileges, but exploitation requires victim user interaction (e.g., clicking a malicious link or approving a consent/authentication prompt). No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is 0.66% (percentile 50%). Microsoft has released a service-side fix for this cloud service, and the vulnerability is rated critical with a CVSS score of 9.6.
Azure Entra ID Elevation of Privilege Vulnerability. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on another tenant. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing authorization in Microsoft Entra ID allows an attacker who already holds a valid low-privilege identity - a compromised user account, guest account, or service principal - to elevate privileges over the network without any user interaction, giving high impact to confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H). Microsoft has published an advisory through MSRC (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83941), but no public exploit code has been identified at time of analysis and the issue is not in CISA KEV; EPSS is only 0.73% (52nd percentile), so this is a genuine priority-worthy finding rather than an emergency. Because Entra ID is a Microsoft-operated multi-tenant cloud service, the affected code is centrally managed and the exact tenant configuration or feature exposing the missing check is not detailed in the advisory.
Privilege escalation in Microsoft Entra ID (formerly Azure Active Directory) lets a remote, unauthenticated attacker bypass authentication through an alternate path or channel and gain elevated privileges over the network. The flaw affects Microsoft's cloud identity-and-access-management service, which underpins sign-in and authorization for Microsoft 365, Azure, and countless federated third-party applications. No public exploit identified at time of analysis and SSVC records exploitation status as none, but the CISA SSVC framework rates the attack as automatable with total technical impact.
Spoofing vulnerability in Microsoft Entra ID (formerly Azure Active Directory) enables an authenticated low-privilege network attacker to forge or manipulate identity data due to insufficient verification of data authenticity (CWE-345), yielding high confidentiality, integrity, and availability impact. The CVSS 8.8 score with PR:L confirms a valid tenant account is required but no elevated privileges are needed, meaning any compromised or legitimately provisioned low-privilege account could serve as a launchpad. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Azure Entra ID (formerly Azure AD) has an elevation of privilege vulnerability allowing attackers to escalate permissions within the identity platform.
Authentication bypass in Microsoft Entra ID (CWE-306, missing authentication for a critical function) lets remote, unauthenticated attackers reach functionality that should require credentials, with maximum impact across confidentiality, integrity, and availability and a CVSS base score of 9.8 (AV:N/AC:L/PR:N/UI:N). Exploitation status is 'no public exploit identified at time of analysis' - the flaw is not listed in CISA KEV and no proof-of-concept was provided - but the EPSS score of 7.66% (94th percentile) marks it as substantially more likely to see exploitation attempts than the typical CVE. Multiple signals converge on genuine high priority, driven by the unauthenticated network vector, the critical-tier score, and the central role Entra ID plays as an identity provider for Microsoft cloud tenants; because Entra ID is a Microsoft-operated multi-tenant service, the vulnerable component is hosted and remediated by Microsoft rather than by customers on their own infrastructure.
Elevation of privilege in Microsoft Entra ID could enable an unauthenticated remote attacker to gain higher privileges, but exploitation requires victim user interaction (e.g., clicking a malicious link or approving a consent/authentication prompt). No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is 0.66% (percentile 50%). Microsoft has released a service-side fix for this cloud service, and the vulnerability is rated critical with a CVSS score of 9.6.
Azure Entra ID Elevation of Privilege Vulnerability. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on another tenant. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.